Information processing device with watchdog timer

ABSTRACT

An information processing device including a recording module to record a program having cleared a watchdog timer; a determination module to refer, when the watchdog timer expires, to the recording module to determine an application to be executed from among a plurality of applications, and to determine an operating system to be executed from among a plurality of operating systems; an execution module to execute the operating system determined by the determination module; and a communication module to notify the operating system to be executed of the application to be executed.

TECHNICAL FIELD

The present invention relates to failure analysis in an informationprocessing device.

BACKGROUND ART

Information processing devices used in a system such as a power plantsystem and a train car system are provided with a watchdog timer(hereinafter, referred to as WDT) in order to monitor a hung-up of thesystem due to a software failure. If the timer is not cleared within apredetermined time (time until timeout), the WDT determines that thesystem has hung up, and resets it. By using the WDT, even when a systemfailure makes the system nonoperational, the WDT can reset the system tooperate it again.

However, in a case where failures frequently occur, the WDT's resetprocessing for the system results in another failure, thereby repeatingthe reset processing and leaving the situation unimproved.

To cope with this problem, for example in Patent Document 1, a method isdisclosed in which two programs are stored in a ROM (Read Only Memory)so that when a failure occurs to a program, the other program isactivated for trying to recover the system.

Patent Document 2 discloses a method in which in accordance with the WDTtimeout occurrence count, a selector circuit selects a bootloader usedfor failure occurrence state as a bootloader to be activated, to outputthe failure occurrence situation.

PRIOR ART DOCUMENT Patent Document

Patent Document 1: Japanese Patent Laid-Open Publication No. 2004-348546

Patent Document 2: Japanese Patent Laid-Open Publication No. 2012-113616

SUMMARY OF THE INVENTION Problems to be Solved by the Invention

Both of the techniques described in Patent Documents 1 and 2 suggest thepossibility that when a system failure occurs, the system recovers byswitching all of programs currently operating to those for failureoccurrence to perform a failure analysis.

Therefore, if a program to be checked by the failure analysis is a largescale program including an operating system, an enormous amount of logsneeds to be checked in the failure cause investigation, taking a quitelong time to identify a failure cause.

Means for Solving the Problem

The present invention is made to solve the problem, and an informationprocessing device is provided which includes a recording module torecord a program having cleared a watchdog timer; a determination moduleto refer, when the watchdog timer expires, to the recording module todetermine an application to be executed from among a plurality ofapplications, and to determine an operating system to be executed fromamong a plurality of operating systems; an execution module to executethe operating system determined by the determination module, and acommunication module to notify the operating system to be executed ofthe application to be executed.

Effects of the Invention

According to the present invention, it becomes possible to identify afailure cause in a short time.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a hardware configuration diagram of an information processingdevice according to Embodiment 1.

FIG. 2 is a block diagram showing a configuration of a storage device ofEmbodiment 1.

FIG. 3 is a diagram showing an example of timing of WDT clearingprocessing of Embodiment 1.

FIG. 4 is a block diagram showing a configuration of a WDT processingdevice of Embodiment 1.

FIG. 5 is a block diagram showing a configuration of WDT information.

FIG. 6 is a functional configuration diagram of Embodiment 1.

FIG. 7 is a flowchart showing operations of the information processingdevice of Embodiment 1.

FIG. 8 is a flowchart showing processing at WDT timeout.

FIG. 9 is a flowchart showing start target investigation processing.

FIG. 10 is a flowchart showing how the WDT processing device operateswhen the WDT is cleared.

FIG. 11 is a flowchart showing how the WDT processing device operateswhen the WDT expires.

EMBODIMENT FOR CARRYING OUT THE INVENTION Embodiment 1

FIG. 1 is a hardware configuration diagram of an information processingdevice 1 according to the present invention. In FIG. 1, a CPU 2 (CentralProcessing Unit) is an arithmetic unit responsible for the overallcontrol of the information processing device 1; a RAM 3 (Random AccessMemory) is a main storage device used as a work area of the CPU 2; astorage device 4 is a nonvolatile storage device such as a flash memoryto store a program including an operating system (hereinafter, referredto as OS) and an application (hereinafter, referred to as AP) which runson the OS; a WDT processing device 5 is a reset device to restart thesystem when clearing processing (processing to reset the WDT to apreconfigured value) has not been performed by an AP or an OS for acertain period and a timeout subsequently occurs.

FIG. 2 is a block diagram showing a configuration of the storage device4 and the content of the storage of this embodiment. The storage device4 includes a bootloader 10, a first OS 21, a second OS 22, a first APregion 31, and a second AP region 32. The bootloader 10 is a programwhich is called by the CPU 2 being a control module, immediately afterpower is applied to the information processing device 1. When called bythe CPU 2, the bootloader 10 initializes the hardware of the informationprocessing device 1, and then boots the OS.

The first OS 21 and the second OS 22 are basic software items which makeapplications operate. The first AP region 31 and the second AP region 32are software groups of applications such as a file system and commands.

Note here, it is assumed that the first OS 21 and the second OS 22 eachinclude an internal process for clearing WDT (WDT clearing processing inthe OSs). The WDT clearing processing in the OS may be performed suchthat: a timer used for the OS is set so as to create interrupts at ashorter interval than the WDT's timeout; and, the WDT is cleared in theinterrupt service routines, tasks or threads.

Also it is assumed that a WDT clearing AP for clearing the WDT isincluded in each of the AP region 31 and the AP region 32, to beexecuted as an AP in its AP region. Similarly with the WDT clearingprocessing in the OS, the WDT clearing AP may be performed such that:the timer used for the OS is set similarly with the WDT clearingprocessing in the OS; and the WDT is cleared in the interrupt serviceroutines, tasks and threads.

Note here that, in a case where only a single AP is provided in the APregion, it is assumed that the process to clear the WDT is included inthe AP itself.

Besides the processing described above, the WDT clearing processing inthe OS and the WDT clearing AP notify the WDT processing device 5 oftheir self-identification information.

When a plurality of devices for performing WDT clearing processing withrespect to the WDT processing device are provided, the WDT processingdevice may determine which device has cleared, to record thisdetermination information. Explanation on timing of the WDT clearingprocessing will be made with reference to FIG. 3.

FIG. 3 is a diagram showing an example of timing of the WDT clearingprocessing. FIG. 3 shows that if a predetermined timeout period elapses,timeout occurs in the WDT processing device 5. To cope with this, theinternal WDT clearing processing in the first OS 21 or the second OS 22prevents timeouts in the WDT processing device by generating interruptsat a period shorter than the timeout period of the WDT processingdevice. Similarly, the WDT clearing processing of the WDT clearing APalso generates interrupts at a period shorter than the timeout period ofthe WDT processing device to prevent timeouts in the WDT processingdevice.

Noted that, in this Embodiment 1, the first OS 21 and the first APregion 31 are respectively an OS and an AP region to be used in a normalstate. The second OS 22 and the second AP region 32 are respectively anOS for debugging and an AP region for debugging, both of which arecapable of outputting logs for failure cause analysis and of monitoringthe operational situation.

Also it is assumed that the first AP region 31 and the second AP region32 are callable either from the first OS 21 and the second OS 22.

Although the example used in this embodiment included two OSs and two APregions, the number of OS and AP may be one, or three or more. Also, thenumber of OSs and the number of the AP regions may be different numbers.

The OS for debugging and the AP region for debugging are provided inthis embodiment, but they may not be provided.

FIG. 4 is a functional configuration diagram of the WDT processingdevice of this embodiment. Besides a function (not shown in the figure)for restarting the CPU 2 in response to the timeout of a timer in theWDT, the WDT processing device 5 is provided with a recording module 51to collect information on the situation when the WDT expires and astorage region 52 to store the information collected by the recordingmodule 51 on the situation when the WDT expires. Note that, in thisEmbodiment 1, although the storage region 52 is assumed to be a part ofthe WDT processing device 5, it may be a part of the storage device 4.

When the WDT expires, the recording module 51 stores the WDT timeoutoccurrence situation information 520 in the storage region 52.

Note that, in this storage region, the information on which program hascleared the WDT may be recorded; that is, information that the WDTclearing processing in the OS has been performed or information that theWDT clearing AP has been performed may be recorded

The detail of the WDT timeout occurrence situation information 520 isshown in FIG. 5. As shown in FIG. 5, the WDT timeout occurrencesituation information 520 includes an update flag 521 indicating theWDT's timeout occurrence situation, history information 522 indicatingwhich OS and AP region are selected from among a plurality of the OSsand a plurality of the AP regions, a WDT timeout occurrence count 523indicating the number of timeouts having occurred after power wasapplied to the information processing device 1, and clearing information524 indicating the program which last cleared the WDT.

The update flag 521 indicates the WDT's timeout occurrence situation,indicating a state of no timeout at the point immediately after power-onto the information processing device 1. When the WDT expires in the WDTprocessing device 5, the recording module 51 is called and the situationwhere the WDT timeout has occurred is written in the update flag 521. Asfor the value to be written in the update flag 521, for example, a valueof “1” is written when the WDT expires, and a value of “0” is writtenwhen it does not expire.

The history information 522 is history information indicating which OSis selected from among a plurality of OSs and which AP region isselected from among a plurality of AP regions. The information iswritten by the bootloader 10. This makes it possible to recordcombinations of the booted OS and the activated AP region from among aplurality of OSs and a plurality of AP regions, so that the bootloader10 can confirm which combination has already been tried so far. Forexample, if a unique identification number is assigned in advance toeach of all the OSs and AP regions to be used in the informationprocessing device 1, and if the values indicating the time and theposition in sequence when they are used are recorded in relation to eachof the identification numbers, it will be possible to determine which OSor AP region has already been used and which OS or AP region iscurrently used.

The occurrence count 523 is the timeout occurrence count of the WDTafter power was applied to the information processing device 1, and isused for determination to change a currently running program. Forexample, a limit value against repetitive occurrence is preset as N, sothat when the WDT timeout occurrence count exceeds N, the currently usedOS will be switched to another OS, or the currently used AP region willbe switched to another AP region.

The clearing information 524 is information indicating the program whichhas cleared the WDT last. For example, if the WDT is cleared in an OS,the information that the OS has cleared the WDT last is written in theclearing information 524 by the WDT processing device 5. Note that,simultaneously with processing in which an OS clears the WDT, theinformation that the OS has cleared the WDT last may be written in theclearing information 524.

With reference to FIG. 6, software modules according to this embodimentwill be explained.

The bootloader 10 is a program which operates first when power isapplied. After getting started, the bootloader 10 initializes thehardware and performs a setting process to boot the OS. Wheninitializing the hardware, the bootloader 10 may, in some cases, checkif there is a failure in the hardware such as RAM 3. When the hardwareinitialization is completed, the bootloader 10 makes an image copy ofthe OS from the storage device 4 into the RAM to boot the OS. Then, theoperation of the bootloader 10 ends. The bootloader 10 includes: adetermination module 101 to determine which OS is to be used from amongthe plurality of OSs (the first OS 21 and the second OS 22) and which APregion including an application and setting for enhancing a log outputfunction thereof is to be used from among the plurality of AP regions(the first AP region 31 and the second AP region 32); a RAM checkingmodule 102 called by the determination module 101 to check whether thereis a failure such as a short-circuit in memory; a program checkingmodule 103 also called by the determination module 101 to check whetherthere is no failure in the OS and the AP region to be started; an OSboot module 104 to boot the OS that the determination module 101 hasdetermined to be used; and a communication module 105 to notify the OSof the AP region that the determination module 101 has determined to beused.

The first OS 21 includes: a communication module 211 to receive, fromthe communication module 105 of the bootloader 10, the information ofthe first AP region 31 or the second AP region 32 which is determined tobe used; and a selection module 212 to activate the first AP region 31or the second AP region 32 in accordance with the selection informationnotified of from the bootloader 10.

Similarly, the second OS 22 includes: a communication module 221 toreceive, from the communication module 105 of the bootloader 10, theinformation of the first AP region 31 or the second AP region 32 whichis determined to be used; and a selection module 222 to activate thefirst AP region 31 or the second AP region 32 in accordance with theselection information notified of by the bootloader.

Next, with reference to FIGS. 7 to 10, the operation of the informationprocessing device 1 will be explained.

FIG. 7 is a flowchart for explaining the operations of the bootloader 10and the OS.

Power is applied to the information processing device 1 to start thebootloader 10. Also when the information processing device 1 is reset bythe WDT processing device 5, the bootloader 10 is started. Thisoperation will be explained later.

When the bootloader 10 is started, the determination module 101 isexecuted.

In the determination module 101, the RAM checking module 102 is calledfirst to perform a RAM check (ST102). The method for the RAM check maybe a simple one such as, first writing “0” in all the regions of thememory, and then reading all the regions to check whether they are all“0”. The method for the RAM check may be a memory check method using amemory test algorithm such as Walking method, Galloping method orMarching method which can find a short-circuit in a data bus and anaddress bus.

If the RAM check finds an abnormality in the RAM, the determinationmodule 101 stops the information processing device 1 (ST104) because theprograms cannot be executed normally.

In a case of RAM abnormality, the bootloader displays on the screen orstores in the storage device 4: the fact that an abnormality is found inthe memory; the address in which the abnormality is found; the valuetried to be written in; and the value actually written in the memory.Then the system will be stopped.

In a case of display on the screen, if power supply is stopped, thescreen will be blacked out. Therefore, the processing of the informationprocessing device 1 has to be stopped with the power being applied. In acase where data remains safe even at a power outage in the storagedevice 4 and others devices, the system may be stopped with the poweroff.

Again in ST102, if the RAM check results in normal, the determinationmodule 101 obtains the WDT information 520 and checks the WDT's timeoutoccurrence situation with reference to the update flag 521 (ST106).

If the determination module finds, with reference to the update flag 521(ST106), that WDT resetting has not occurred, the determination module101 selects an OS and an AP region that the information processingdevice 1 has used in the previous start operation (ST108). The order inwhich the OSs and the AP regions, included in the information processingdevice 1, have been executed is recorded in the history information 522,so that, with reference to the history information 522, thedetermination module 101 selects the OS and the AP region having beenused in the previous start operation.

Immediately after power is applied, there is no information on the OSand the AP region having been used in the previous start operation.Therefore, the OS and the AP region to be used immediately after poweris applied may be set in advance so that the system can follow thesettings.

Again in ST106, if the determination module finds, with reference to theupdate flag 521, that the WDT has expired (a WDT timeout has occurredand the information processing device 1 has been reset), thedetermination module 101 selects a start target in accordance with theWDT's timeout occurrence situation (ST107).

With reference to FIG. 8, selection of the start target in accordancewith the WDT's reset occurrence situation will be explained.

First, the determination module 101 obtains the WDT information 520included in the WDT processing device 5 (ST201).

Next, the determination module 101 compares the occurrence count 523recorded in the WDT information 520 with a predetermined limit value Nof the WDT timeout occurrence count (ST202). The predetermined number Nis a value for checking the repetition frequency of the WDT. Forexample, if the system is required not to halt its operation as much aspossible even when a failure occurs, N should be a small number likefive so that the OS and the applications will be switched early todifferent ones in order to find a situation in which the WDT will notexpire again after then.

On the other hand, if the system is required to keep operating as longas possible under a specific combination of an OS and applications, Nshould be a larger number like twenty.

If the occurrence count 523 is equal to or less than the predeterminednumber N, the determination module 101 sets null to the update flag 521to indicate that the WDT has not expired (ST203).

The determination module 101 selects the OS and the AP region used inthe previous start operation of the information processing device 1(ST108).

Then, the determination module 101 calls the program checking module 103to check (ST110) memory areas of the OS and the AP region selected inST108.

Again in ST202, when the occurrence count in the WDT information 520exceeds the predetermined N, the determination module 101 refers to theclearing information 524 recorded in the WDT timeout occurrencesituation information 520 to determine whether it was an OS or an APregion that was running at the moment of the WDT's timeout (ST204). Ifthe clearing information 524 indicates an OS, it can be determined thatthe WDT has expired because an abnormality has occurred somewhere in theOS operation. Similarly, if the clearing information 524 indicates an APregion, it can be determined that the WDT has expired while anapplication in the AP region was running.

If it is determined that an OS is responsible for the WDT timeout, thedetermination module 101 switches the boot target OSs (ST205).

In switching the boot target OSs, the determination module 101 refers tothe history information 522. For example, if it is found that the firstOS 21 has been executed in the past and the second OS 22 has not beenexecuted in the past, the second OS 22 will be the boot target.Similarly, if it is determined that the AP region is responsible for theWDT timeout, the determination module 101 changes settings so as toswitch the activation targets in AP regions. Similarly to the case inOS, the determination module 101 switches the activation targets in APregions with reference to the history information 522.

The determination module 101 records the fact that no WDT timeout hasoccurred. Taking an example used in the explanation of FIG. 5, “0” issubstituted for the update flag 521 (ST207).

Now explanation on FIG. 8 ends to return to explanation on FIG. 7.

The determination module 101 calls the program checking module 103 tocheck whether there is no failure in the memory areas assigned to the OSand the AP region selected as the start targets (ST110). CyclicRedundancy Check, summation check or the like may be used to checkwhether there is no failure in the memory areas.

If the program checking module 103 resultantly finds an error in thememory areas, start target investigation processing will be performed(ST111) because at least one of the OS and the AP region that have beenselected as the start targets cannot be started.

With reference to FIG. 9, explanation will be made about processing in acase where a failure is found in the memory areas assigned to the OS andthe AP region selected as the start targets.

If the program checking module 103 resultantly finds a failure in thememory area of the OS (ST301), the determination module 101 refers tothe history information 522 and checks whether an alternative OS otherthan the OS currently selected as the boot target exists (ST302).

If all the OSs have already been selected as the boot targets, and thusno other OS can be selected, in short if it is impossible to switch OSs,the determination module 101 inputs to and records in the historyinformation 522, the information on the OS which was last tried as theboot target (ST303). As explained in FIG. 5, the information to beinputted only needs to include information by which the sequence of theselected start targets can be known.

Then the determination module 101 stops the information processingdevice 1 (ST304).

Again in ST302, if there is another OS to be selected, namely ifswitching is possible, the determination module 101 selects the OS to bebooted next (ST305).

In switching the boot target OSs, the determination module 101 refers tothe history information 522. For example, if the first OS 21 has beenexecuted and the second OS 22 has not been executed, the second OS 22will be selected as the boot target.

The determination module 101 calls the program checking module 103 tocheck whether there is no failure in the memory areas assigned to the OSand the AP region selected as the start targets (ST309).

If the program checking module 103 resultantly finds an error in thememory areas, the procedure returns again to the top (ST301) of thestart target investigation processing because the OS or the AP regionselected as the start target cannot be started. If no error is found,the start target investigation processing ends and the procedure returnsto FIG. 7.

In FIG. 9, the process not explained so far will be explained next.

Again in ST301, if the program checking module 103 resultantly finds afailure in the memory area of the AP region, the determination module101 checks whether an alternative AP region other than the AP regioncurrently selected as the activation target exists (ST306).

If all the AP regions have already been selected as the activationtargets, and thus no other AP region can be selected, in short if it isimpossible to switch AP regions, the determination module 101 inputs toand records in the history information 522, the information on the APregion which was last tried as the activation target (ST303). Similarlyto the case where a failure is found in the memory area of the OS, theinformation to be inputted only needs, as explained in FIG. 5, toinclude information by which the sequence of the selected activationtargets can be known.

Then, the determination module 101 stops the information processingdevice 1 (ST304).

Again in ST306, if there is another AP region to be selected, namely ifit is possible to switch AP regions, the determination module 101selects the AP region to be activated next (ST307). The method forselecting an AP region to be activated next is the same as that for OS.

The determination module 101 calls the program checking module 103 tocheck whether there is no failure in the memory areas assigned to the OSand the AP region selected as the start targets (ST309).

If the program checking module 103 resultantly finds an error in thememory areas, the procedure returns again to the top (ST301) of thestart target investigation processing because the OS or the AP regionselected as the start target cannot be started. If no error is found,the start target investigation processing ends and the procedure returnsto FIG. 7.

Now explanation on FIG. 9 ends to return to FIG. 7.

The determination module 101 inputs to and records in the historyinformation 522, the information on the OS and the AP region selected asthe start targets (ST112).

The determination module 101 executes the OS boot module 104 to boot theOS selected as the boot target (ST113). Note that it is assumed herethat the first OS and the second AP region have been selected as thestart targets.

The determination module 101 executes the communication module 105 tonotify the OS selected as the boot target of the information on the APregion selected as the activation target (ST114).

The communication module 211 of the first OS 21 receives the informationon the AP region selected as the activation target (ST115).

From this point on, when the first OS 21 executes an AP, the selectionmodule 212 selects the second AP region 32 on the basis of theinformation on the AP region selected as the activation target. Thefirst OS 21 activates an AP in the second AP region 32 (ST116).

Note that, in this embodiment, the information on the AP region selectedas the activation target is communicated by using the communicationmodule 105 in the bootloader 5 and the communication module 211 in thefirst OS 21. There may be another way in which the determination module101 writes the information somewhere in the storage device 4 so that theOS can check the written information when booted.

Next, with reference to FIG. 10 and FIG. 11, the processing of the WDTprocessing device 5 will be explained. The processing of the WDTprocessing device 5 includes processing to be conducted when the OS orthe AP clears the WDT, and processing to be conducted when the WDT isnot cleared and then expires.

FIG. 10 is a flowchart of the WDT processing device 5 when the OS or theAP clears the WDT.

When the WDT is cleared by the WDT clearing processing in the OS or bythe WDT clearing processing in the AP region, the WDT processing device5 reads the change in a signal to extend the WDT timer. After extendingthe WDT timer, the WDT processing device 5 executes the recording module51.

Referring to the storage region 52, the recording module 51 records theinformation on the program which performed the WDT clearing processing,in the clearing information 524 (ST401). In this embodiment, it isexplained that the recording module 51 records the information on theprogram which performed the WDT clearing processing, in the clearinginformation 524. However, such information may be recorded by the WDTclearing processing in the OS or the WDT clearing AP, which are on theside for performing the WDT clearing processing.

FIG. 11 is a flowchart of the WDT processing device 5 when no WDTclearing processing is performed from anywhere, resulting in a WDTtimeout.

If the WDT is kept uncleared from anywhere, a timeout occurs. Then, theWDT processing device 5 executes the recording module 51; the hardwarereset function is called; and the system restarts.

The recording module 51 sets to the update flag 521, a flag indicatingthat the WDT has expired (ST501).

Next, referring to the occurrence count 523, the recording module 51adds one to the referred value (ST502) to record the resulting value inthe occurrence count 523 (ST503).

Then, the WDT processing device 5 resets the information processingdevice 1.

With the configuration described above, by referring to the WDTinformation 520 recorded by the WDT processing device 5, the bootloader10 can select an OS and an AP region to be started. The OS selected as aboot target can activate an AP in the AP region to be activated byreceiving from the bootloader 10, the information on the AP region to beactivated.

Depending on the control devices, a device such as a flash memory with alimitation number for rewriting may sometimes be used as a log recordingmedia. In such a case, a problem is that the service lifetime of theflash memory will be shortened if a large amount of operating logs arealways outputted.

If a normal AP in the AP region causes a failure in a system that isconfigured as described above and provided with a normal OS and the APas well as those having an output function for debugging, the system canswitch, while keeping running the normal OS, the AP in the AP region tothat having the debugging-output function, thereby reducing unnecessarylog information. As the result, a failure cause can be identified in ashort time.

DESCRIPTION OF SYMBOLS

-   1: information processing device-   2: CPU-   3: RAM-   4: storage device-   5: WDT processing device-   10: bootloader-   21: first OS-   22: second OS-   31: first AP region-   32: second AP region-   51: recording module-   52: storage region-   101: determination module-   102: RAM checking module-   103: program checking module-   104: OS boot module-   105: communication module-   211: communication module-   212: selection module-   221: communication module-   222: selection module-   520: WDT information-   521: update flag-   522: history information-   523: occurrence count-   524: clearing information

The invention claimed is:
 1. An information processing device formonitoring a system for a hang-up due to a software failure, theinformation processing device comprising: a watch dog timer; a memoryhaving stored therein a plurality of operating systems, a plurality ofapplications; and information identifying a program executed when thewatch dog timer was last cleared; a processor configured to record watchdog timer occurrence situation information in the memory; select, whenthe watchdog timer expires, an application to be executed from among theplurality of applications, and an operating system to be executed fromamong the plurality of operating systems based on the informationidentifying the program executed when the watch dog timer was lastcleared; execute the selected operating system, and notify the executedoperating system of the selected application to be executed.
 2. Theinformation processing device according to claim 1, wherein if theinformation identifying the program executed when the watch dog timerwas last cleared indicates that the program was an application, theprocessor selects from the plurality operating systems, the operatingsystem corresponding to an operating system having been executed last;and if the information identifying the program executed when the watchdog timer was last cleared indicates that the program was an operatingsystem, the processor selects from the plurality of applications, theapplication corresponding an application having been executed last. 3.The information processing device according to claim 2, wherein theprocessor further records a number of timeouts of the watchdog timer,and selects, when the number exceeds a predetermined number, theapplication to be executed and the operating system to be executed. 4.The information processing device according to claim 1, wherein theprocessor further records a number of timeouts of the watchdog timer,and selects, when the number exceeds a predetermined number, theapplication to be executed and the operating system to be executed.